{"id":22060,"date":"2026-09-25T10:39:53","date_gmt":"2026-09-25T10:39:53","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=22060"},"modified":"2026-09-25T10:39:53","modified_gmt":"2026-09-25T10:39:53","slug":"amazon-aws-certified-security-specialty-scs-c03-practice-test-questions-and-exam-dumps-part18-q341-360","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/amazon-aws-certified-security-specialty-scs-c03-practice-test-questions-and-exam-dumps-part18-q341-360\/","title":{"rendered":"Amazon AWS Certified Security – Specialty SCS-C03 Practice Test Questions and Exam Dumps Part18 Q341-360"},"content":{"rendered":"

View Full <\/b>Amazon AWS Certified Security – Specialty SCS-C03 Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 341<\/b><\/h3>\n

A company wants to ensure that a sensitive S3 bucket cannot be accessed from outside its AWS Organization. Which policy condition can help enforce this requirement?<\/b><\/p>\n

    \n
  1. aws:SourceIp<\/span><\/li>\n
  2. aws:PrincipalOrgID<\/span><\/li>\n
  3. aws:RequestedRegion<\/span><\/li>\n
  4. aws:SourceVpce<\/span><\/li>\n<\/ol>\n

    Correct Answer: 2<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    The <\/span>aws:PrincipalOrgID<\/span> condition key can be used in supported resource policies to restrict access based on the AWS Organization of the requesting principal. This is useful when a company wants resources to be accessible only by principals belonging to its organization. It can reduce the risk of accidentally granting access to external accounts. Security teams should still verify the specific principal permissions, because organization membership alone does not grant access. Combining organizational restrictions with least privilege, logging, encryption, and network controls provides stronger protection for sensitive resources.<\/span><\/p>\n

    Question 342<\/b><\/h3>\n

    An organization wants to require that API operations involving sensitive resources occur only in approved AWS Regions. Which IAM condition key is appropriate?<\/b><\/p>\n

      \n
    1. aws:SourceVpce<\/span><\/li>\n
    2. aws:PrincipalOrgID<\/span><\/li>\n
    3. aws:RequestedRegion<\/span><\/li>\n
    4. aws:MultiFactorAuthPresent<\/span><\/li>\n<\/ol>\n

      Correct Answer: 3<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      The <\/span>aws:RequestedRegion<\/span> condition key can be used in IAM policies to restrict requests according to the AWS Region where the operation is being performed. Organizations can use this control to prevent users or workloads from creating or modifying resources in Regions that are not approved by their security or compliance requirements. The condition should be designed carefully because some AWS services have global endpoints or related operations that may require separate consideration. Region restrictions work best alongside SCPs, IAM policies, and centralized governance controls.<\/span><\/p>\n

      Question 343<\/b><\/h3>\n

      A security team needs to detect unexpected creation of IAM access keys for investigation. Which AWS service provides the API activity needed for this analysis?<\/b><\/p>\n

        \n
      1. AWS CloudTrail<\/span><\/li>\n
      2. Amazon Macie<\/span><\/li>\n
      3. AWS Backup<\/span><\/li>\n
      4. AWS Private CA<\/span><\/li>\n<\/ol>\n

        Correct Answer: 1<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        AWS CloudTrail records supported IAM API operations, including activities related to creating, modifying, and deleting access keys. Security teams can monitor these events to identify unexpected credential creation and investigate which identity performed the operation. CloudTrail records useful context such as the event name, identity information, source address, and timestamp. Organizations can combine CloudTrail with CloudWatch alarms, EventBridge automation, or Security Hub workflows to respond to suspicious activity. Access-key creation should be tightly controlled because long-lived credentials can increase the risk of unauthorized access.<\/span><\/p>\n

        Question 344<\/b><\/h3>\n

        An application requires temporary AWS permissions to perform a task and should not use long-term access keys. Which AWS service provides temporary security credentials?<\/b><\/p>\n

          \n
        1. AWS Artifact<\/span><\/li>\n
        2. AWS Config<\/span><\/li>\n
        3. AWS Systems Manager<\/span><\/li>\n
        4. AWS Security Token Service<\/span><\/li>\n<\/ol>\n

          Correct Answer: 4<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          AWS Security Token Service provides temporary security credentials that can be used by applications, users, and workloads when assuming authorized roles or using supported federation mechanisms. Temporary credentials include an access key ID, secret access key, and session token and expire after a defined period. This reduces reliance on long-term credentials that may remain valid if accidentally exposed. Security teams should still apply least privilege to the role being assumed and protect the mechanism that obtains the temporary credentials. Temporary credentials are a fundamental component of secure AWS identity architecture.<\/span><\/p>\n

          Question 345<\/b><\/h3>\n

          A security administrator wants to ensure that an S3 bucket rejects requests that do not use HTTPS. Which policy condition should be used?<\/b><\/p>\n

            \n
          1. aws:SecureTransport<\/span><\/li>\n
          2. aws:SourceVpce<\/span><\/li>\n
          3. aws:PrincipalOrgID<\/span><\/li>\n
          4. aws:RequestedRegion<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            The <\/span>aws:SecureTransport<\/span> condition key can be used in an S3 bucket policy to enforce secure transport requirements. A common design uses an explicit deny when a request is made without secure transport, preventing unencrypted HTTP communication from accessing the bucket. This helps protect data while it travels between the client and AWS service endpoint. Security teams should also consider encryption at rest, identity permissions, and network restrictions. Transport security should be tested against all legitimate clients and applications before enforcing a restrictive policy in production.<\/span><\/p>\n

            Question 346<\/b><\/h3>\n

            A company wants to require MFA before privileged IAM users can perform sensitive operations. Which policy element can enforce this requirement?<\/b><\/p>\n

              \n
            1. aws:SourceIp<\/span><\/li>\n
            2. aws:MultiFactorAuthPresent<\/span><\/li>\n
            3. aws:RequestedRegion<\/span><\/li>\n
            4. aws:PrincipalOrgID<\/span><\/li>\n<\/ol>\n

              Correct Answer: 2<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              The <\/span>aws:MultiFactorAuthPresent<\/span> condition key can be used in IAM policies to make access dependent on MFA context. Organizations can use it to add an authentication requirement around sensitive operations performed by IAM users or supported temporary credential workflows. Policy behavior should be tested carefully because MFA context can differ depending on how credentials are obtained. Security teams should combine MFA requirements with least privilege and centralized identity management. MFA strengthens authentication, but it does not replace authorization controls that determine which actions a principal is permitted to perform.<\/span><\/p>\n

              Question 347<\/b><\/h3>\n

              A security team needs to analyze whether a VPC route table and security group configuration permit traffic between two specific resources. Which AWS capability is most appropriate?<\/b><\/p>\n

                \n
              1. Amazon Detective<\/span><\/li>\n
              2. AWS Network Firewall<\/span><\/li>\n
              3. VPC Reachability Analyzer<\/span><\/li>\n
              4. AWS Audit Manager<\/span><\/li>\n<\/ol>\n

                Correct Answer: 3<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                VPC Reachability Analyzer analyzes network paths between specified resources and identifies whether connectivity is possible based on the configured network components. It can evaluate route tables, security groups, network ACLs, gateways, and other supported components that affect the path. This helps security teams verify intended network segmentation and troubleshoot unexpected access. Reachability Analyzer does not determine whether an application user is authorized to perform a business action. It focuses on network connectivity, so it should be combined with IAM, application authentication, and other security controls.<\/span><\/p>\n

                Question 348<\/b><\/h3>\n

                A company wants to prevent a compromised EC2 workload from using overly broad permissions assigned to its instance role. Which principle should guide the role design?<\/b><\/p>\n

                  \n
                1. Shared administrator credentials<\/span><\/li>\n
                2. Least privilege<\/span><\/li>\n
                3. Public access<\/span><\/li>\n
                4. Permanent root credentials<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 2<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  The principle of least privilege requires an EC2 instance role to have only the permissions necessary for the workload’s intended functions. If an instance becomes compromised, excessive permissions can increase the attacker’s ability to access other resources or perform destructive operations. Security teams should identify required API actions and resources, then create narrowly scoped policies instead of granting broad service-level or administrator permissions. Access should be reviewed periodically because application requirements change. CloudTrail activity and IAM analysis can provide useful evidence when refining permissions over time.<\/span><\/p>\n

                  Question 349<\/b><\/h3>\n

                  A security administrator wants to centrally apply AWS WAF rules across multiple accounts and supported resources. Which AWS service provides centralized policy management for this purpose?<\/b><\/p>\n

                    \n
                  1. AWS Firewall Manager<\/span><\/li>\n
                  2. Amazon Macie<\/span><\/li>\n
                  3. AWS Private CA<\/span><\/li>\n
                  4. AWS Artifact<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    AWS Firewall Manager provides centralized security policy management across supported AWS accounts and resources within an organization. Security teams can use it to establish consistent AWS WAF protections and other supported security policies without manually configuring every account independently. This helps reduce configuration drift and makes organization-wide enforcement easier. Firewall Manager works with AWS Organizations and supported resources, so administrators should define organizational scope carefully. Centralized policy management should still allow appropriate application-specific exceptions where required, while maintaining the organization’s baseline security requirements.<\/span><\/p>\n

                    Question 350<\/b><\/h3>\n

                    A security team wants to identify sensitive information stored in S3 objects, including data types such as credentials or personally identifiable information. Which AWS service is designed for this purpose?<\/b><\/p>\n

                      \n
                    1. Amazon Inspector<\/span><\/li>\n
                    2. Amazon Macie<\/span><\/li>\n
                    3. AWS Config<\/span><\/li>\n
                    4. AWS Shield<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 2<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      Amazon Macie is designed to discover and help protect sensitive data stored in Amazon S3. It can analyze objects and identify data types that may represent sensitive information, including certain personally identifiable information and credentials. Security teams can use Macie findings to prioritize investigation, improve data classification, and identify unexpected exposure of sensitive information. Macie should be combined with S3 access controls, encryption, logging, and data-retention policies. Organizations should also configure discovery activities appropriately so that monitoring aligns with the sensitivity and business importance of their data.<\/span><\/p>\n

                      Question 351<\/b><\/h3>\n

                      A company wants to create a centralized security account where security administrators can manage findings from multiple AWS accounts. Which AWS service supports centralized security findings management?<\/b><\/p>\n

                        \n
                      1. Amazon Security Hub<\/span><\/li>\n
                      2. AWS Certificate Manager<\/span><\/li>\n
                      3. Amazon CloudFront<\/span><\/li>\n
                      4. AWS Backup<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        Amazon Security Hub can aggregate security findings across multiple AWS accounts and supported AWS security services and partner integrations. Organizations commonly designate a security administrator account to manage centralized security operations while member accounts continue running their workloads. This arrangement improves visibility and allows security teams to investigate findings from a central location. Proper organization configuration and permissions are required. Security Hub should be integrated with services such as GuardDuty, Inspector, and Macie where appropriate so that security teams can correlate findings across multiple detection and assessment sources.<\/span><\/p>\n

                        Question 352<\/b><\/h3>\n

                        A company wants to collect security-related telemetry from multiple AWS accounts and normalize supported findings into a standardized cybersecurity schema. Which service is designed for this purpose?<\/b><\/p>\n

                          \n
                        1. AWS Audit Manager<\/span><\/li>\n
                        2. Amazon Security Lake<\/span><\/li>\n
                        3. AWS Artifact<\/span><\/li>\n
                        4. AWS Config<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 2<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          Amazon Security Lake is designed to centralize security data from supported sources and normalize information using the Open Cybersecurity Schema Framework. This provides a standardized foundation for security analytics across multiple accounts and data sources. Normalization can make it easier for security teams and analytics tools to work with data from different systems without building a completely separate format for every source. Security Lake should be configured with appropriate data sources, retention, encryption, and access permissions. It complements detection services by providing a centralized security-data repository.<\/span><\/p>\n

                          Question 353<\/b><\/h3>\n

                          An organization wants to detect whether an EC2 instance has a known vulnerable software package installed. Which service is specifically designed for vulnerability assessment?<\/b><\/p>\n

                            \n
                          1. Amazon Inspector<\/span><\/li>\n
                          2. Amazon Macie<\/span><\/li>\n
                          3. AWS WAF<\/span><\/li>\n
                          4. AWS Artifact<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            Amazon Inspector can assess supported AWS workloads for software vulnerabilities and other security findings. For supported EC2 environments, it can identify vulnerable packages and provide information that helps security teams prioritize remediation. This is different from GuardDuty, which focuses primarily on threat detection and suspicious activity. Inspector findings should be incorporated into vulnerability-management processes so that critical issues are patched or otherwise mitigated. Organizations should also consider workload exposure, exploitability, asset importance, and available compensating controls when prioritizing remediation activities.<\/span><\/p>\n

                            Question 354<\/b><\/h3>\n

                            A security engineer needs to store application credentials securely and retrieve them at runtime without placing the credentials directly in source code. Which AWS service is designed for this requirement?<\/b><\/p>\n

                              \n
                            1. Amazon Macie<\/span><\/li>\n
                            2. AWS Secrets Manager<\/span><\/li>\n
                            3. AWS Shield<\/span><\/li>\n
                            4. AWS Artifact<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 2<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              AWS Secrets Manager is designed to securely store and manage sensitive information such as database credentials, API keys, and other secrets. Applications can retrieve secrets at runtime through authorized API calls rather than embedding permanent credentials directly in source code or configuration files. Secrets Manager also supports features such as automatic rotation for supported use cases. Security teams should restrict access to each secret using least-privilege IAM permissions and protect associated KMS keys. Applications should avoid logging secret values because runtime retrieval does not prevent accidental disclosure through application logs.<\/span><\/p>\n

                              Question 355<\/b><\/h3>\n

                              A company wants to record DNS queries generated from resources inside its VPC for security investigations. Which Route 53 capability should be configured?<\/b><\/p>\n

                                \n
                              1. Route 53 Resolver query logging<\/span><\/li>\n
                              2. Route 53 health checks<\/span><\/li>\n
                              3. Route 53 domain registration<\/span><\/li>\n
                              4. Route 53 traffic policies<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                Route 53 Resolver query logging can record DNS queries made through the VPC Resolver. Security teams can use these records to investigate suspicious domain lookups, identify unusual destinations, and support incident-response activities. DNS telemetry can provide useful evidence when a compromised workload attempts to communicate with command-and-control infrastructure or suspicious domains. Query logging should be configured with appropriate destinations, permissions, and retention. It works well alongside DNS Firewall, VPC Flow Logs, GuardDuty, and application telemetry because DNS information alone may not reveal the complete nature of an incident.<\/span><\/p>\n

                                Question 356<\/b><\/h3>\n

                                A security team wants to prevent workloads from resolving known malicious domains through Amazon Route 53 Resolver. Which feature is most appropriate?<\/b><\/p>\n

                                  \n
                                1. AWS Network Firewall<\/span><\/li>\n
                                2. Route 53 Resolver DNS Firewall<\/span><\/li>\n
                                3. AWS Shield Advanced<\/span><\/li>\n
                                4. IAM Access Analyzer<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 2<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  Route 53 Resolver DNS Firewall can help control DNS queries originating from resources in a VPC. Organizations can use rule groups to block or allow domain names according to security requirements. This can provide a preventive layer against connections to known malicious or unwanted domains. DNS Firewall should be combined with other network and endpoint protections because attackers may use alternative resolution methods or direct IP communication. Security teams should monitor DNS activity and regularly review domain lists so that the controls remain aligned with current threat intelligence and business requirements.<\/span><\/p>\n

                                  Question 357<\/b><\/h3>\n

                                  A security administrator needs to identify which IAM roles or users have policies that allow access to resources outside the organization. Which service can analyze resource-based policies for unintended external access?<\/b><\/p>\n

                                    \n
                                  1. AWS Config<\/span><\/li>\n
                                  2. Amazon Detective<\/span><\/li>\n
                                  3. IAM Access Analyzer<\/span><\/li>\n
                                  4. Amazon Inspector<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 3<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    IAM Access Analyzer can identify supported resources that are accessible from outside an intended trust boundary by analyzing resource-based policies. This helps security teams discover unintended external access and determine whether the relationship is required. Findings can reveal external principals or access paths that deserve review. Organizations should investigate each finding because some external access may be intentional, such as approved partner integrations. Access Analyzer is therefore a discovery and analysis capability rather than an automatic replacement for business authorization decisions.<\/span><\/p>\n

                                    Question 358<\/b><\/h3>\n

                                    A company wants to automatically route a high-severity Security Hub finding to an incident-response workflow. Which service can receive the finding event and initiate automation?<\/b><\/p>\n

                                      \n
                                    1. AWS EventBridge<\/span><\/li>\n
                                    2. AWS Artifact<\/span><\/li>\n
                                    3. Amazon Macie<\/span><\/li>\n
                                    4. AWS Private CA<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 1<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      Amazon EventBridge can receive supported Security Hub finding events and route them according to defined event patterns. A security team can use EventBridge to trigger downstream actions such as Lambda functions, Systems Manager Automation, or notification workflows. This enables automated responses to findings that meet defined conditions, such as severity or resource type. Automation should be carefully designed to avoid taking disruptive actions on false positives or incorrectly classified findings. Security teams should test event patterns and response workflows before enabling automated remediation in production environments.<\/span><\/p>\n

                                      Question 359<\/b><\/h3>\n

                                      A security team wants to retain audit records in a separate AWS account so administrators of application accounts cannot easily modify the centralized logs. Which architecture provides stronger separation?<\/b><\/p>\n

                                        \n
                                      1. Store all logs in each application account<\/span><\/li>\n
                                      2. Use the root user for daily administration<\/span><\/li>\n
                                      3. Store centralized logs in a dedicated security or logging account<\/span><\/li>\n
                                      4. Disable log retention after investigations<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 3<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        A dedicated security or logging account provides an administrative boundary between application workloads and centralized audit data. Application account administrators can be restricted from modifying or deleting the centralized copies of important logs. This architecture can improve the reliability of forensic evidence and support organization-wide monitoring. The logging account should have tightly controlled permissions, appropriate encryption, retention policies, and monitoring. Organizations should also consider log integrity validation and immutable storage where required. Separation of duties is particularly valuable when investigating incidents involving compromised application accounts.<\/span><\/p>\n

                                        Question 360<\/b><\/h3>\n

                                        A company wants to evaluate AWS resources continuously against defined security configuration requirements and detect when a resource becomes noncompliant. Which AWS service should be used?<\/b><\/p>\n

                                          \n
                                        1. AWS Config<\/span><\/li>\n
                                        2. AWS Shield<\/span><\/li>\n
                                        3. Amazon CloudFront<\/span><\/li>\n
                                        4. AWS Artifact<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 1<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          AWS Config continuously records supported resource configurations and can evaluate them against defined compliance rules. This allows security teams to detect when resources move from a compliant state to a noncompliant state. Config can evaluate conditions such as security group settings, encryption configurations, or public-access controls depending on the selected rules. Detected violations can be investigated or connected to remediation workflows. Continuous configuration monitoring is different from vulnerability scanning or threat detection, so organizations should use Config alongside services such as Inspector and GuardDuty for broader security coverage.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Amazon AWS Certified Security – Specialty SCS-C03 Exam Dumps and Practice Test Dumps.   Question 341 A company wants to ensure that a sensitive S3 bucket cannot be accessed from outside its AWS Organization. Which policy condition can help enforce this requirement? aws:SourceIp aws:PrincipalOrgID aws:RequestedRegion aws:SourceVpce Correct Answer: 2 Explanation The aws:PrincipalOrgID condition […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/22060"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=22060"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/22060\/revisions"}],"predecessor-version":[{"id":22061,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/22060\/revisions\/22061"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=22060"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=22060"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=22060"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}